Responsible security disclosure would say you've got a responsibility to make the bug known. Making it public should only happen after you've made the creator aware.

I can understand why the developer viewed you as 'trashing' his work, you claimed it as a phishing expedition. That'd make the best of us upset. I see you've sorted it out between you which is great, and I hope others look at this exchange and get some good takeaway from it.